Re: UPDATE: net/wget -current,-stable (CVE-2017-13089, CVE-2017-13090)

On 2017/10/31 12:20, Rafael Sadowski wrote:
> Hi All,
>
> Update Wget to the latest stable version 1.19.1. This version includes
> the following CVE patches:
>
> "Fix stack overflow in HTTP protocol handling (CVE-2017-13089)"
> http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f
>
> "Fix heap overflow in HTTP protocol handling (CVE-2017-13090)"
> http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba
>
> 1.19.1 provide only .tar.lz and tar.gz. Since we don't support *.lz, I
> have decided to *.gz
>
> Also please find attached a diff for -stable.
>
> Ok? Feedback?
>
> Best regards,
>
> Rafael Sadowski
>
>
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/net/wget/Makefile,v
> retrieving revision 1.72
> diff -u -p -u -p -r1.72 Makefile
> --- Makefile 22 Feb 2017 02:49:25 -0000 1.72
> +++ Makefile 31 Oct 2017 10:54:50 -0000
> @@ -2,7 +2,7 @@
>
> COMMENT = retrieve files from the web via HTTP, HTTPS and FTP
>
> -DISTNAME = wget-1.19.1
> +DISTNAME = wget-1.19.2
> CATEGORIES = net
>
> HOMEPAGE = https://www.gnu.org/software/wget/
> @@ -17,7 +17,7 @@ LIB_DEPENDS = converters/libunistring \
> net/libpsl
>
> MASTER_SITES = ${MASTER_SITE_GNU:=wget/}
> -EXTRACT_SUFX = .tar.xz
> +EXTRACT_SUFX = .tar.gz

.tar.gz is the default, so just remove EXTRACT_SUFX. (We do have support
for .lz but at least for -stable it's easier for people if they don't
have to install a weird compression tool :)

> -+++ doc/wget.texi Sat Feb 11 16:46:13 2017
> -@@ -191,14 +191,14 @@ gauge can be customized to your preferences.
> - Most of the features are fully configurable, either through command line
> - options, or via the initialization file @file{.wgetrc} (@pxref{Startup
> - File}). Wget allows you to define @dfn{global} startup files
> --(@file{/usr/local/etc/wgetrc} by default) for site settings. You can also
> -+(@file{${SYSCONFDIR}/wgetrc} by default) for site settings. You can also
> - specify the location of a startup file with the --config option.
> -
> -
> - @ignore
> - @c man begin FILES
> - @table @samp
> --@item /usr/local/etc/wgetrc
> -+@item ${SYSCONFDIR}/wgetrc
> - Default location of the @dfn{global} startup file.
> -
> - @item .wgetrc

That hunk of the patch needs merging by hand.